✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Understanding OAuth Redirection Abuse in Phishing Attacks
In March 2026, Microsoft identified a sophisticated phishing campaign exploiting OAuth's redirection mechanisms to deliver malware. Attackers crafted URLs using legitimate identity providers like Microsoft Entra ID and Google Workspace, embedding them in phishing emails with themes such as e-signature requests and financial documents. When recipients clicked these links, they were redirected through trusted domains to attacker-controlled sites, leading to malware downloads. This method effectively bypassed traditional email and browser security defenses, resulting in significant compromises across government and public-sector organizations. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/?utm_source=openai)) This incident underscores a growing trend where threat actors leverage legitimate protocol features to conduct malicious activities. The abuse of OAuth redirection highlights the need for organizations to enhance monitoring of authentication flows and implement stricter controls over third-party application permissions to mitigate such evolving threats.
5 months ago
Kill Chain
CrushFTP 2025 Brute-Force Attack Highlights Credential Vulnerabilities
In March 2025, CrushFTP servers were targeted by brute-force attacks exploiting default or weak credentials, particularly the 'crushadmin' account with the password 'crushadmin'. These attacks originated from IP address 5.189.139.225, a French IP with a history of exploit attempts targeting simple vulnerabilities. The attackers aimed to gain unauthorized administrative access, potentially leading to data exfiltration and system compromise. This incident underscores the critical importance of enforcing strong password policies and regularly updating default credentials to prevent unauthorized access. Organizations are advised to review their authentication mechanisms and implement multi-factor authentication where possible to mitigate such risks.
5 months ago
Kill Chain
March 2026 Iranian Cyberattacks: A Wake-Up Call for Critical Infrastructure Security
In early March 2026, Iranian state-sponsored cyber actors launched a series of coordinated cyberattacks targeting critical infrastructure and government entities across the United States and its allies. These attacks included sophisticated phishing campaigns, deployment of data-exfiltrating malware, and disruptive operations attributed to Iranian-aligned hacktivist groups. The cyber offensive coincided with heightened geopolitical tensions following military strikes in the region, leading to significant disruptions in services and raising concerns over national security vulnerabilities. The escalation underscores the persistent threat posed by nation-state actors leveraging cyber capabilities to achieve strategic objectives. Organizations are urged to enhance their cybersecurity posture, as the current geopolitical climate suggests a continued risk of similar cyber operations targeting critical infrastructure and sensitive data.
5 months ago
Kill Chain
Google's March 2026 Android Security Update Addresses Critical Qualcomm Zero-Day
In March 2026, Google disclosed a high-severity zero-day vulnerability (CVE-2026-21385) affecting an open-source Qualcomm display component in Android devices. This memory-corruption flaw, reported to Qualcomm on December 18, 2025, impacts 234 chipsets. Qualcomm notified its customers on February 2, 2026, and provided fixes in January 2026. The vulnerability has been under limited, targeted exploitation, though specific details on the extent and impact remain undisclosed. ([cyberscoop.com](https://cyberscoop.com/android-security-update-march-2026/?utm_source=openai)) This incident underscores the critical importance of timely security updates and coordinated disclosure practices. The surge in Android vulnerabilities, with 129 defects addressed in this update—the highest since April 2018—highlights the evolving threat landscape and the necessity for robust vulnerability management strategies. ([cyberscoop.com](https://cyberscoop.com/android-security-update-march-2026/?utm_source=openai))
5 months ago
Kill Chain
Phishing Campaign Exploits Fake Google Security Page and PWA to Steal Credentials
In March 2026, a sophisticated phishing campaign emerged, utilizing a counterfeit Google Account security page to deploy a malicious Progressive Web App (PWA). This app deceived users into granting permissions that enabled the theft of one-time passcodes, cryptocurrency wallet addresses, and other sensitive data. Additionally, the malware transformed victims' browsers into proxies for attacker traffic, facilitating further network exploitation. The attackers employed the domain google-prism[.]com to mimic legitimate Google services, leading users through a deceptive setup process that included installing the harmful PWA and, in some cases, a companion Android application. This incident underscores the evolving tactics of cybercriminals who exploit trusted platforms and social engineering to bypass traditional security measures. The use of PWAs in phishing attacks highlights the need for heightened vigilance and the adoption of advanced security protocols to protect against such sophisticated threats.
5 months ago
Kill Chain
APT28's Exploitation of MSHTML Zero-Day Vulnerability in February 2026
In early 2026, the Russian state-sponsored threat actor APT28 exploited a zero-day vulnerability, CVE-2026-21513, in the MSHTML Framework. This high-severity flaw allowed attackers to bypass security features by convincing users to open malicious HTML or shortcut files, leading to potential code execution. The exploitation occurred before Microsoft's February 2026 Patch Tuesday, which subsequently addressed the vulnerability. ([thehackernews.com](https://thehackernews.com/2026/03/apt28-tied-to-cve-2026-21513-mshtml-0.html?utm_source=openai)) The incident underscores the persistent threat posed by state-sponsored actors leveraging zero-day vulnerabilities. Organizations are reminded of the critical importance of timely patch management and user education to mitigate risks associated with such sophisticated attacks.
5 months ago
Kill Chain
Understanding the 2026 RTF Malware Delivery Exploit
In early 2026, cybersecurity researchers identified a sophisticated malware delivery method exploiting Rich Text Format (RTF) files. Attackers embedded malicious ZIP files within RTF documents, which, when opened, executed embedded scripts to download and install malware on the victim's system. This technique bypassed traditional security measures by leveraging the inherent trust in RTF files and the complexity of detecting embedded compressed files. The campaign targeted various sectors, leading to data breaches and operational disruptions. This incident underscores the evolving tactics of cyber adversaries who continuously adapt to circumvent security defenses. The use of RTF files for malware delivery highlights the need for organizations to enhance their email filtering, user awareness training, and endpoint detection capabilities to mitigate such threats.
5 months ago
Kill Chain
AI-Enhanced Reconnaissance: Adapting to the New Cyber Threat Landscape
In 2026, cyber adversaries have increasingly leveraged AI-enhanced reconnaissance techniques to conduct 'silent probing' campaigns. These operations involve prolonged, subtle monitoring of organizational defenses to map detection thresholds, response times, and operational routines. By analyzing defender behaviors over time, attackers can tailor subsequent attacks to evade detection and maximize impact. This shift from targeting technical vulnerabilities to exploiting behavioral patterns has led to more sophisticated and successful breaches, underscoring the need for adaptive and unpredictable defense strategies. The rise of AI-driven reconnaissance signifies a paradigm shift in cyber threats, emphasizing the importance of behavioral analysis in security postures. Organizations must now contend with adversaries who can learn and adapt to their defensive measures, making traditional, static security protocols insufficient. This evolution necessitates a reevaluation of incident response strategies to incorporate dynamic and behavior-based defense mechanisms.
5 months ago
Kill Chain
AI-Assisted Cyberattack Compromises 600+ FortiGate Firewalls Globally
Between January 11 and February 18, 2026, a Russian-speaking threat actor utilized commercial generative AI tools to compromise over 600 Fortinet FortiGate firewalls across 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking two-factor authentication, without leveraging any specific software vulnerabilities. Once access was gained, AI-generated scripts were employed to extract and decrypt sensitive data, including SSL-VPN credentials, administrative passwords, and network configurations. This information facilitated further network infiltration and reconnaissance activities. ([cybernews.com](https://cybernews.com/security/threat-actor-ai-tools-claude-fortinet-fortigate/?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools enable even low-skilled attackers to execute large-scale, sophisticated cyberattacks. Organizations must reassess their security postures, emphasizing the importance of robust authentication mechanisms and the need to secure management interfaces against unauthorized access.
5 months ago
Kill Chain
South Korea Tax Agency's Data Exposure Results in $4.8M Crypto Theft
In February 2026, South Korea's National Tax Service (NTS) inadvertently exposed the mnemonic recovery phrase of a seized cryptocurrency wallet in an official press release. This oversight allowed unauthorized individuals to access and transfer approximately 4 million Pre-Retogeum (PRTG) tokens, valued at $4.8 million, from the wallet. The incident underscores significant lapses in the secure handling of digital assets by governmental bodies. This event highlights the critical need for stringent operational security measures when managing and disclosing information related to digital assets. The exposure of sensitive data, such as wallet recovery phrases, can lead to substantial financial losses and erode public trust in institutional competence.
5 months ago
Kill Chain
Cisco Catalyst SD-WAN Authentication Bypass Vulnerability Exploited Since 2023
In February 2026, Cisco disclosed a critical authentication bypass vulnerability (CVE-2026-20127) in its Catalyst SD-WAN Controller and Manager, rated with a CVSS score of 10.0. This flaw allows unauthenticated, remote attackers to gain high-privileged access by exploiting a malfunctioning peering authentication mechanism. The threat actor group UAT-8616 has been actively exploiting this vulnerability since at least 2023, enabling them to manipulate SD-WAN fabric configurations via the NETCONF protocol. The exploitation involves downgrading the SD-WAN system to a vulnerable version, achieving root access, and restoring the original firmware to evade detection. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-rpa-EHchtZk.html?utm_source=openai)) The urgency of this issue is underscored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) adding CVE-2026-20127 to its Known Exploited Vulnerabilities catalog, mandating immediate remediation by federal agencies. This incident highlights the persistent threat posed by sophisticated actors targeting critical infrastructure components, emphasizing the need for organizations to promptly apply patches, monitor for unauthorized access, and implement robust network segmentation to mitigate potential impacts. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-rpa-EHchtZk.html?utm_source=openai))
5 months ago
Kill Chain
Understanding the RESURGE Malware: A 2025 Cybersecurity Threat
In early 2025, the Cybersecurity and Infrastructure Security Agency (CISA) identified a sophisticated malware variant named RESURGE, which exploited the critical vulnerability CVE-2025-0282 in Ivanti Connect Secure appliances. This vulnerability allowed unauthenticated remote code execution, enabling attackers to deploy RESURGE to establish persistent access, create web shells, harvest credentials, and escalate privileges. The malware's advanced evasion techniques, including network-level stealth and boot-level persistence, posed significant challenges for detection and remediation. The emergence of RESURGE underscores a growing trend of advanced persistent threats targeting critical infrastructure through zero-day vulnerabilities. Organizations must prioritize timely patching, implement robust monitoring systems, and adopt a zero-trust security model to mitigate such sophisticated attacks.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports